{"id":259,"date":"2020-08-11T07:57:40","date_gmt":"2020-08-11T07:57:40","guid":{"rendered":"http:\/\/www.rnm.in\/blog\/?p=259"},"modified":"2025-01-30T10:55:45","modified_gmt":"2025-01-30T10:55:45","slug":"the-three-lines-model","status":"publish","type":"post","link":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/","title":{"rendered":"The Three Lines Model: July 2020 \u2013 An Oversight"},"content":{"rendered":"\n
The Three Lines Model has replaced previously known Three Lines of Defense model in July 2020. This updated Model helps organizations identify structures and processes that help in achievement of objectives and facilitate better governance and risk management. The model applies to all organizations and is optimized by:
– Adopting a more flexible principles-based approach suiting objectives and environment of the organization.
– Concurrent focus on contribution risk management as well as to matters of \u201cdefense\u201d and protecting value.
– Explaining the roles and responsibilities and the relationships among them.
– Creating enablers to ensure activities and objectives are aligned to achieve key \/ prioritized interests of stakeholders. <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The Three\nLines Model lays down 6 principles:<\/p>\n\n\n\n

Principle 1: Governance of an organization requires appropriate enabling structures and processes.<\/p>\n\n\n\n

Principle 2: Governing body\u2019s role is to create enablers for governance and align entity objectives to stakeholders\u2019 expectations. <\/p>\n\n\n\n

Principle 3:\nManagement is responsible to achieve organizational objectives through first\nand second line roles.<\/p>\n\n\n\n

Principle 4:\nInternal audit provides independent and objective assurance and advice as Third\nline role<\/p>\n\n\n\n

Principle 5:\nInternal audit is independence from management <\/p>\n\n\n\n

Principle 6: All roles are working together to collectively contribute to the creation and protection of value <\/p>\n\n\n\n

How the model function<\/strong><\/p>\n\n\n\n

Structure, roles, and responsibilities <\/strong><\/p>\n\n\n\n

For being\nmost effective, the \u2018Three Lines of Defense Model\u2019 is required to be configured\nand implemented in line with the goals and environment of the entity.\nManagement and Governing body of the organization ascertains its structure and\nassigning of roles and responsibilities though appropriate delegation. <\/p>\n\n\n\n

The management\nmay set up role specific committees to provide desired supervision for relevant\ndimensions \u2013 like responsibility, audit, risk, finance, planning, and\ncompensation \/ remuneration. Within management, there would be operational and line\n(command) arrangements when entities are more obsessed toward specialization in\nview of growing size and complexity of the organizations. <\/p>\n\n\n\n

Various\ndepartments, teams, and even individuals might have been assigned responsibilities\nconsisting of roles that are covering the activities which falls on first and\nsecond lines. Through efficient management of the roles, direction and\noversight under the second line roles may be configured in a manner that secures\nrequired level of independence from those with first line roles \u2014 and even from\nthe most senior levels of management. But the same requires establishing\nprimary accountability and reporting lines to the governing body.<\/p>\n\n\n\n

Updated \u2018Three\nLines Model\u2019 permits creation of as many reporting lines between management and\nthe governing body as required according to the need of the organization. In\nsome organizations, especially the regulated financial institutions, creation\nof such multiple lines is mandated by the regulatory body (like RBI or NHB) to\nensure sufficient degree of independence. But even in these scenarios, those charged\nwith management at first line roles are primarily responsible for managing\nrisk. <\/p>\n\n\n\n

Those\nmanaging the second line roles would perform monitoring, advice, guidance,\ntesting, analyzing, and reporting on matters related to the management of risk.\nAs such these functions provide support and challenge to those responsible for\nthe first line roles and plays pivotal role in management decisions and actions.\nFurther, these second line roles are as such part of management\u2019s key responsibilities.\nThese are not independent from management, irrespective of reporting lines and\naccountabilities. <\/p>\n\n\n\n

The key characteristic\nof the third line roles is their independence from those responsible for management.\nThe six principles of the ne \u2018Three Lines Model\u2019 explains the importance and\nnature of independence of internal audit function, establishing internal audit separately\nfrom other functions and enabling the distinctive value of its assurance and\nadvice. <\/p>\n\n\n\n

Independence\nof internal audit function is protected and ensured by <\/p>\n\n\n\n

    \n
  • Not making decisions or taking actions that are\npart of management\u2019s responsibilities (including risk management); and <\/li>\n\n\n\n
  • Not provide assurance on those activities for\nwhich internal auditor is currently responsible or was responsible in recent\npast. <\/li>\n<\/ul>\n\n\n\n

    Indian\nbusiness environment is full of examples wherein the Internal Audit Manager is\ndischarging additional decision-making responsibilities over activities\nutilizing similar competencies, like certain aspects of statutory compliance or\nERM. Under such conditions, internal audit is not independent of these\nactivities or of their results. Accordingly, an independent and qualified third\nparty may be roped in when the governing body is looking for independent and\nobjective assurance and advice relating to those areas. <\/p>\n\n\n\n

    Assurance and Oversight<\/strong><\/p>\n\n\n\n

    The Board of\nDirectors relies on the information and reports from management – consisting of\ndesignated officials performing first and second line roles, internal auditors\n(i.e. the third line), and others responsible officials in order to exercise\noversight and achievement of its objectives assigned by stakeholders. <\/p>\n\n\n\n

    Management\nprovides desired level of assurance on key areas \u2013 like budgets and plans,\nactual performance, projections, types of risk (existence), and risk management\nby using its experience and expertise of their respective domain. The second\nline role officials provide additional assurance on risk-related matters. The\nassurance provided by internal auditors (which is independence from management)\ncarries the highest degree of objectivity and confidence. Irrespective of\nreporting lines, the level of objectivity and confidence is far above the level\nwhich is normally provided by those responsible for the first and second line\nroles. <\/p>\n\n\n\n

    Alignment and Coordination<\/strong><\/p>\n\n\n\n

    Appropriate\ndelegation of responsibilities and strong alignment of activities through cooperation,\ncollaboration, and communication is the key for effective governance requires.\nThe Board of Directors obtains objective confirmation through internal audit\nthat governance structures and processes are appropriately designed and\noperating as intended (through various reports). One such format mandated by\nlaw is report on Internal Financial Control (IFC) in India. <\/p>\n","protected":false},"excerpt":{"rendered":"

    The Three Lines Model has replaced previously known Three Lines of Defense model in July 2020. This updated Model helps organizations identify structures and processes that help in achievement of objectives and facilitate better governance and risk management. The model applies to all organizations and is optimized by:– Adopting a more flexible principles-based approach suiting objectives and environment of the […]<\/p>\n","protected":false},"author":3,"featured_media":261,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"categories":[17,14],"tags":[18,85],"class_list":["post-259","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-assurance","category-general","tag-internal-audit","tag-risk-management"],"yoast_head":"\nThe Three Lines Model: A Modern Approach to Risk Management<\/title>\n<meta name=\"description\" content=\"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Three Lines Model: A Modern Approach to Risk Management\" \/>\n<meta property=\"og:description\" content=\"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\" \/>\n<meta property=\"og:site_name\" content=\"RNM India Blogs\" \/>\n<meta property=\"article:published_time\" content=\"2020-08-11T07:57:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-01-30T10:55:45+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2240\" \/>\n\t<meta property=\"og:image:height\" content=\"1260\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Rnm\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rnm\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\"},\"author\":{\"name\":\"Rnm\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/c803658b38f2490f6a75863d05644438\"},\"headline\":\"The Three Lines Model: July 2020 \u2013 An Oversight\",\"datePublished\":\"2020-08-11T07:57:40+00:00\",\"dateModified\":\"2025-01-30T10:55:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\"},\"wordCount\":912,\"publisher\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png\",\"keywords\":[\"Internal Audit\",\"Risk Management\"],\"articleSection\":[\"Assurance\",\"General\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\",\"url\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\",\"name\":\"The Three Lines Model: A Modern Approach to Risk Management\",\"isPartOf\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png\",\"datePublished\":\"2020-08-11T07:57:40+00:00\",\"dateModified\":\"2025-01-30T10:55:45+00:00\",\"description\":\"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage\",\"url\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png\",\"contentUrl\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png\",\"width\":2240,\"height\":1260,\"caption\":\"Risk Management\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.rnm.in\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Three Lines Model: July 2020 \u2013 An Oversight\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#website\",\"url\":\"https:\/\/www.rnm.in\/blog\/\",\"name\":\"RNM India Blogs\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.rnm.in\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#organization\",\"name\":\"RNM India Blogs\",\"url\":\"https:\/\/www.rnm.in\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2024\/08\/cropped-logo.png\",\"contentUrl\":\"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2024\/08\/cropped-logo.png\",\"width\":137,\"height\":72,\"caption\":\"RNM India Blogs\"},\"image\":{\"@id\":\"https:\/\/www.rnm.in\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/c803658b38f2490f6a75863d05644438\",\"name\":\"Rnm\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/719d6dbaa9fb6a42b8e1c14dec8f0172?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/719d6dbaa9fb6a42b8e1c14dec8f0172?s=96&d=mm&r=g\",\"caption\":\"Rnm\"},\"url\":\"https:\/\/www.rnm.in\/blog\/author\/rnm\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Three Lines Model: A Modern Approach to Risk Management","description":"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/","og_locale":"en_US","og_type":"article","og_title":"The Three Lines Model: A Modern Approach to Risk Management","og_description":"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.","og_url":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/","og_site_name":"RNM India Blogs","article_published_time":"2020-08-11T07:57:40+00:00","article_modified_time":"2025-01-30T10:55:45+00:00","og_image":[{"width":2240,"height":1260,"url":"http:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png","type":"image\/png"}],"author":"Rnm","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rnm","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#article","isPartOf":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/"},"author":{"name":"Rnm","@id":"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/c803658b38f2490f6a75863d05644438"},"headline":"The Three Lines Model: July 2020 \u2013 An Oversight","datePublished":"2020-08-11T07:57:40+00:00","dateModified":"2025-01-30T10:55:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/"},"wordCount":912,"publisher":{"@id":"https:\/\/www.rnm.in\/blog\/#organization"},"image":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage"},"thumbnailUrl":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png","keywords":["Internal Audit","Risk Management"],"articleSection":["Assurance","General"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/","url":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/","name":"The Three Lines Model: A Modern Approach to Risk Management","isPartOf":{"@id":"https:\/\/www.rnm.in\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage"},"image":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage"},"thumbnailUrl":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png","datePublished":"2020-08-11T07:57:40+00:00","dateModified":"2025-01-30T10:55:45+00:00","description":"The Three Lines Model is a modern approach to risk management that is designed to help organizations identify, assess, and manage risks.","breadcrumb":{"@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.rnm.in\/blog\/the-three-lines-model\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#primaryimage","url":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png","contentUrl":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2020\/08\/The-Three-Lines-Model.png","width":2240,"height":1260,"caption":"Risk Management"},{"@type":"BreadcrumbList","@id":"https:\/\/www.rnm.in\/blog\/the-three-lines-model\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.rnm.in\/blog\/"},{"@type":"ListItem","position":2,"name":"The Three Lines Model: July 2020 \u2013 An Oversight"}]},{"@type":"WebSite","@id":"https:\/\/www.rnm.in\/blog\/#website","url":"https:\/\/www.rnm.in\/blog\/","name":"RNM India Blogs","description":"","publisher":{"@id":"https:\/\/www.rnm.in\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.rnm.in\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.rnm.in\/blog\/#organization","name":"RNM India Blogs","url":"https:\/\/www.rnm.in\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rnm.in\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2024\/08\/cropped-logo.png","contentUrl":"https:\/\/www.rnm.in\/blog\/wp-content\/uploads\/2024\/08\/cropped-logo.png","width":137,"height":72,"caption":"RNM India Blogs"},"image":{"@id":"https:\/\/www.rnm.in\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/c803658b38f2490f6a75863d05644438","name":"Rnm","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.rnm.in\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/719d6dbaa9fb6a42b8e1c14dec8f0172?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/719d6dbaa9fb6a42b8e1c14dec8f0172?s=96&d=mm&r=g","caption":"Rnm"},"url":"https:\/\/www.rnm.in\/blog\/author\/rnm\/"}]}},"_links":{"self":[{"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/posts\/259"}],"collection":[{"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/comments?post=259"}],"version-history":[{"count":3,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/posts\/259\/revisions"}],"predecessor-version":[{"id":1386,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/posts\/259\/revisions\/1386"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/media\/261"}],"wp:attachment":[{"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/media?parent=259"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/categories?post=259"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rnm.in\/blog\/wp-json\/wp\/v2\/tags?post=259"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}